Remove special Firefox instructions in >=.NET 6 sections #33472

tdykstra · 2024-08-29T01:47:05Z

Internal previews

📄 File	🔗 Preview link
aspnetcore/security/enforcing-ssl.md	Enforce HTTPS in ASP.NET Core

aspnetcore/security/enforcing-ssl.md

Co-authored-by: Rick Anderson <[email protected]>

amcasey · 2024-09-06T19:19:10Z

I think these changes were probably prompted by a comment from me, but I can't recall the context. Would you happen to have a link or something?

aspnetcore/security/enforcing-ssl.md

amcasey · 2024-09-06T19:39:20Z

aspnetcore/security/enforcing-ssl.md

@@ -345,36 +301,6 @@ For chromium browsers on Linux:

 <a name="trust-ff-linux"></a>

-#### Trust the certificate with Firefox on Linux


Why delete, rather than update, this section? It seems like we could just tell people to run certutil as for Chromium.

There's a note in an unedited part of this document (above) that says certutil is "legacy". I'm not sure why - maybe just the specific version linked?

Above, where it says to run certutil twice, it should probably only be run once - with "P,," for Chromium or "C,," for Firefox.

Why delete, rather than update, this section? It seems like we could just tell people to run certutil as for Chromium.

Are the instructions different using certutil on FF different than for Chromium? If not, we'll make sure the Chromium instructions say Chromium and FF.

There's a note in an unedited part of this document (above) that says certutil is "legacy". I'm not sure why - maybe just the specific version linked?

the legacy comment is only for the the Red Hat Enterprise Linux tab

Are the instructions different using certutil on FF different than for Chromium? If not, we'll make sure the Chromium instructions say Chromium and FF.

The two differences are the usage, as noted in my comment, and the location of the database. Otherwise, it should be the same.

Rick-Anderson · 2024-09-06T19:45:46Z

I think these changes were probably prompted by a comment from me, but I can't recall the context. Would you happen to have a link or something?

#33221

aspnetcore/security/enforcing-ssl.md

Rick-Anderson · 2024-09-06T21:08:32Z

aspnetcore/security/enforcing-ssl.md

@@ -345,36 +301,6 @@ For chromium browsers on Linux:

 <a name="trust-ff-linux"></a>

-#### Trust the certificate with Firefox on Linux


Why delete, rather than update, this section? It seems like we could just tell people to run certutil as for Chromium.

Are the instructions different using certutil on FF different than for Chromium? If not, we'll make sure the Chromium instructions say Chromium and FF.

Rick-Anderson · 2024-09-06T21:15:55Z

aspnetcore/security/enforcing-ssl.md

@@ -345,36 +301,6 @@ For chromium browsers on Linux:

 <a name="trust-ff-linux"></a>

-#### Trust the certificate with Firefox on Linux


There's a note in an unedited part of this document (above) that says certutil is "legacy". I'm not sure why - maybe just the specific version linked?

the legacy comment is only for the the Red Hat Enterprise Linux tab

Rick-Anderson · 2024-09-06T21:22:23Z

aspnetcore/security/enforcing-ssl.md

@@ -1003,6 +915,8 @@ For chromium browsers on Linux:

 ### Trust the certificate with Firefox on Linux

+In some instances the Firefox browser uses its own certificate store, and therefore doesn't trust the [IIS Express](/iis/extensions/introduction-to-iis-express/iis-express-overview) or [Kestrel](xref:fundamentals/servers/kestrel) developer certificates and requires the following instructions. 
+


@amcasey and @tdykstra I think in the FF section we should add something like the following:

In some instances theses instructions don't work with Firefox on Linux. See [Trust the HTTPS certificate with Firefox](https://learn.microsoft.com/en-us/aspnet/core/security/enforcing-ssl?view=aspnetcore-5.0&tabs=visual-studio%2Clinux-ubuntu#trust-the-https-certificate-with-firefox-to-prevent-sec_error_inadequate_key_usage-error-1] for alternative instructions. The link goes back to .NET 5 and has all the previous instructions.

AFAIK, the old instructions apply to old version of Firefox, rather than to old versions of .NET. If you're on a new enough .NET that --trust works, no Firefox-specific steps should be required. Otherwise, the instructions should be as for Chromium, but with "C,," and different locations.

Or maybe I've misunderstood your suggestion? I'm not entirely sure where in the document this text occurs.

AFAIK, the old instructions apply to old version of Firefox, rather than to old versions of .NET. If you're on a new enough .NET that --trust works, no Firefox-specific steps should be required. Otherwise, the instructions should be as for Chromium, but with "C,," and different locations.

Or maybe I've misunderstood your suggestion? I'm not entirely sure where in the document this text occurs.

Great, we'll replace that with older versions of FF

amcasey · 2024-09-06T21:47:15Z

aspnetcore/security/enforcing-ssl.md

@@ -905,6 +815,8 @@ dotnet dev-certs https --help

 ### Trust the HTTPS certificate with Firefox to prevent SEC_ERROR_INADEQUATE_KEY_USAGE error

+In some instances the Firefox browser uses its own certificate store, and therefore doesn't trust the [IIS Express](/iis/extensions/introduction-to-iis-express/iis-express-overview) or [Kestrel](xref:fundamentals/servers/kestrel) developer certificates and requires the following instructions. 


This seems to overlap substantially with the following paragraph.

amcasey · 2024-09-06T21:49:29Z

aspnetcore/security/enforcing-ssl.md

@@ -1003,6 +915,8 @@ For chromium browsers on Linux:

 ### Trust the certificate with Firefox on Linux

+In some instances the Firefox browser uses its own certificate store, and therefore doesn't trust the [IIS Express](/iis/extensions/introduction-to-iis-express/iis-express-overview) or [Kestrel](xref:fundamentals/servers/kestrel) developer certificates and requires the following instructions. 
+


AFAIK, the old instructions apply to old version of Firefox, rather than to old versions of .NET. If you're on a new enough .NET that --trust works, no Firefox-specific steps should be required. Otherwise, the instructions should be as for Chromium, but with "C,," and different locations.

Or maybe I've misunderstood your suggestion? I'm not entirely sure where in the document this text occurs.

tdykstra · 2024-09-09T22:42:45Z

Addressed by #33221

Remove special Firefox instructions in >=.NET 6 sections

61b14af

tdykstra requested review from Rick-Anderson and amcasey August 29, 2024 02:40

tdykstra marked this pull request as ready for review August 29, 2024 02:43

Rick-Anderson requested changes Sep 5, 2024

View reviewed changes

aspnetcore/security/enforcing-ssl.md Outdated Show resolved Hide resolved

aspnetcore/security/enforcing-ssl.md Outdated Show resolved Hide resolved

tdykstra and others added 2 commits September 5, 2024 13:38

Update aspnetcore/security/enforcing-ssl.md

ea619ed

Co-authored-by: Rick Anderson <[email protected]>

Update aspnetcore/security/enforcing-ssl.md

f45ab8b

Co-authored-by: Rick Anderson <[email protected]>

tdykstra requested a review from Rick-Anderson September 5, 2024 20:38

amcasey requested changes Sep 6, 2024

View reviewed changes

Rick-Anderson requested changes Sep 6, 2024

View reviewed changes

amcasey reviewed Sep 6, 2024

View reviewed changes

tdykstra closed this Sep 9, 2024

tdykstra deleted the tdykstra-patch-2 branch November 13, 2024 00:03

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Remove special Firefox instructions in >=.NET 6 sections #33472

Remove special Firefox instructions in >=.NET 6 sections #33472

tdykstra commented Aug 29, 2024 •

edited by github-actions bot

Loading

amcasey commented Sep 6, 2024

amcasey Sep 6, 2024

amcasey Sep 6, 2024

amcasey Sep 6, 2024

Rick-Anderson Sep 6, 2024

Rick-Anderson Sep 6, 2024

amcasey Sep 6, 2024

Rick-Anderson commented Sep 6, 2024

Rick-Anderson Sep 6, 2024

Rick-Anderson Sep 6, 2024

Rick-Anderson Sep 6, 2024

amcasey Sep 6, 2024

Rick-Anderson Sep 6, 2024

amcasey Sep 6, 2024

amcasey Sep 6, 2024

tdykstra commented Sep 9, 2024

		@@ -345,36 +301,6 @@ For chromium browsers on Linux:

		<a name="trust-ff-linux"></a>

		#### Trust the certificate with Firefox on Linux

		@@ -1003,6 +915,8 @@ For chromium browsers on Linux:

		### Trust the certificate with Firefox on Linux

		In some instances the Firefox browser uses its own certificate store, and therefore doesn't trust the [IIS Express](/iis/extensions/introduction-to-iis-express/iis-express-overview) or [Kestrel](xref:fundamentals/servers/kestrel) developer certificates and requires the following instructions.

		@@ -905,6 +815,8 @@ dotnet dev-certs https --help

		### Trust the HTTPS certificate with Firefox to prevent SEC_ERROR_INADEQUATE_KEY_USAGE error

		In some instances the Firefox browser uses its own certificate store, and therefore doesn't trust the [IIS Express](/iis/extensions/introduction-to-iis-express/iis-express-overview) or [Kestrel](xref:fundamentals/servers/kestrel) developer certificates and requires the following instructions.

Remove special Firefox instructions in >=.NET 6 sections #33472

Remove special Firefox instructions in >=.NET 6 sections #33472

Conversation

tdykstra commented Aug 29, 2024 • edited by github-actions bot Loading

Internal previews

amcasey commented Sep 6, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Rick-Anderson commented Sep 6, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tdykstra commented Sep 9, 2024

tdykstra commented Aug 29, 2024 •

edited by github-actions bot

Loading